containers:
  - name: sidecarinjector-test/egress-container/istio-proxy
    args:
      - proxy
      - router
      - --domain
      - $(POD_NAMESPACE).svc.cluster.local
      - --proxyLogLevel=warning
      - --proxyComponentLogLevel=misc:error
      - --log_output_level=default:warn
      - --serviceCluster
      - istio-egressgateway
    env:
      - name: ISTIO_META_DNS_CAPTURE
        value: "true"
      - name: ISTIO_META_DNS_AUTO_ALLOCATE
        value: "true"
      - name: PROXY_XDS_VIA_AGENT
        value: "true"
      - name: ISTIO_META_UNPRIVILEGED_POD
        value: "true"
      - name: JWT_POLICY
        value: first-party-jwt
      - name: PILOT_CERT_PROVIDER
        value: istiod
      - name: CA_ADDR
        value: istiod-basic.maksim-istio-system-2-1.svc:15012
      - name: NODE_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.nodeName
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
      - name: INSTANCE_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.podIP
      - name: HOST_IP
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: status.hostIP
      - name: SERVICE_ACCOUNT
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: spec.serviceAccountName
      - name: CANONICAL_SERVICE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels['service.istio.io/canonical-name']
      - name: CANONICAL_REVISION
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.labels['service.istio.io/canonical-revision']
      - name: ISTIO_META_WORKLOAD_NAME
        value: istio-egressgateway
      - name: ISTIO_META_OWNER
        value: kubernetes://apis/apps/v1/namespaces/maksim-istio-system-2-1/deployments/istio-egressgateway
      - name: ISTIO_META_ROUTER_MODE
        value: standard
      - name: ISTIO_META_CLUSTER_ID
        value: Kubernetes
      - name: TESTARG
        value: {% or (index .Annotations "vault.k8s-integration.sfdc.com/role") "Test" %}
    image: registry.redhat.io/openshift-service-mesh/proxyv2-rhel8@sha256:13f566dca713189e5bdb4c67c1754fafc1ebc3f8b9696ccb2093f927d186737f
    imagePullPolicy: IfNotPresent
    ports:
      - containerPort: {% or (index .Annotations "port/value") 1111 %}
        name: http2
        protocol: TCP
      - containerPort: 8443
        name: https
        protocol: TCP
      - containerPort: 15443
        name: tls
        protocol: TCP
      - containerPort: 15090
        name: http-envoy-prom
        protocol: TCP
    readinessProbe:
      failureThreshold: 30
      httpGet:
        path: /healthz/ready
        port: 15021
        scheme: HTTP
      initialDelaySeconds: 1
      periodSeconds: 2
      successThreshold: 1
      timeoutSeconds: 1
    resources:
      limits:
        cpu: 100m
        memory: 100m
      requests:
        cpu: 100m
        memory: 100m
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
          - KILL
          - MKNOD
          - SETGID
          - SETUID
      privileged: false
      readOnlyRootFilesystem: true
      runAsUser: 1001530000
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
      - mountPath: /etc/istio/proxy
        name: istio-envoy
      - mountPath: /etc/istio/config
        name: config-volume
      - mountPath: /var/run/secrets/istio
        name: istiod-ca-cert
      - mountPath: /var/lib/istio/data
        name: istio-data
      - mountPath: /etc/istio/pod
        name: podinfo
      - mountPath: /etc/istio/egressgateway-certs
        name: egressgateway-certs
        readOnly: true
      - mountPath: /etc/istio/egressgateway-ca-certs
        name: egressgateway-ca-certs
        readOnly: true
      - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
        name: istio-egressgateway-service-account-token-bg47v
        readOnly: true